Computer interlocking systems must not only control routes, signals and switches under its required interlocking conditions and time sequences, but also collect status information. In order to enhance the reliability during a 24-hour non-stop operation of a railway system or a metropolitan rail transportation system, the computer interlocking system should adopt hardware safety redundancy structures, for example, a dual-machine hot-standby structure that uses a dual 2 out of 2 (2oo2) mode or a 2 out of 3 (2oo3) mode. The dual 2 out of 2 mode is a redundancy configuration that includes two identical sets. Each set has two functional modules which have the same functions and check with each other over the time. Only when operations of the two modules of a set have the same results, the respective set provides effective output, which is the so called 2oo2 mode. The 2 out of 3 mode is a redundancy configuration that includes three functional modules which have the same functions. A voter is added to the output of the three modules. As long as any two of the modules have the same output, the output of the voter will be the AND function of the output of the two modules.
An interlocking processing system has a double hot-redundancy configuration consisting of two subsystems A and B. Each subsystem applies a 2oo2 configuration. Regardless whether the A system and the B system are simultaneously activated, the two systems will be automatically synchronized if both systems function correctly and synchronization check conditions are satisfied. When one subsystem is malfunctioning, the interlocking processing system will switch to the standby subsystem. Switching between the two subsystems can also be manually achieved by the system-switching button on the machine body. Such switching would not affect the working of the interlocking processing system.
Current computer interlocking systems use a working subsystem and a standby subsystem or a board level hot standby may be obtained. Although the two subsystems simultaneously collect information, each subsystem only uses the information it collects for interlocking calculation. Moreover, only the working subsystem has an output to a relay of an interface circuit so as to control field equipment. Under this working mechanism, when the two subsystems both encounter malfunction which should not affect the normal working of the system, neither of the two subsystems can complete its tasks. Therefore, this working mechanism compromises the efficiency of a computer interlocking system in its application to large scale stations.